Applications of Graph Integration to Function Comparison and Malware Classification

2018-10-11 · Michael A. Slawinski, Andy Wortman

We classify .NET files as either benign or malicious by examining directed graphs derived from the set of functions comprising the given file. Each graph is viewed probabilistically as a Markov chain where each node represents a code block of the corresponding function, and by computing the PageRank vector (Perron vector with transport), a probability measure can be defined over the nodes of the given graph. Each graph is vectorized by computing Lebesgue antiderivatives of hand-engineered functions defined on the vertex set of the given graph against the PageRank measure. Files are subsequently vectorized by aggregating the set of vectors corresponding to the set of graphs resulting from decompiling the given file. The result is a fast, intuitive, and easy-to-compute glass-box vectorization scheme, which can be leveraged for training a standalone classifier or to augment an existing feature space. We refer to this vectorization technique as PageRank Measure Integration Vectorization (PMIV). We demonstrate the efficacy of PMIV by training a vanilla random forest on 2.5 million samples of decompiled .NET, evenly split between benign and malicious, from our in-house corpus and compare this model to a baseline model which leverages a text-only feature space. The median time needed for decompilation and scoring was 24ms.

📄 PDF Abstract BibTeX arXiv:1810.04789

Code (1)

gtownrocks/grafuple 공식 구현

Tasks

Classification General Classification Malware Classification

A Comparison of Graph Neural Networks for Malware Classification

2023-03-22 · Vrinda Malhotra, Katerina Potika, Mark Stamp

Managing the threat posed by malware requires accurate detection and classification techniques. Traditional detection strategies, such as signature scanning, rely on manual analysis of malware to extract relevant feature…

Classification Graph Classification Graph Neural Network Malware Classification

Representation learning with function call graph transformations for malware open set recognition

2022-05-13 · Jingyun Jia, Philip K. Chan

Open set recognition (OSR) problem has been a challenge in many machine learning (ML) applications, such as security. As new/unknown malware families occur regularly, it is difficult to exhaust samples that cover all the…

Malware Classification Open Set Learning Representation Learning

On Benchmarking Code LLMs for Android Malware Analysis

2025-04-01 · Yiling He, Hongyu She, Xingzhi Qian, Xinran Zheng 외

Large Language Models (LLMs) have demonstrated strong capabilities in various code intelligence tasks. However, their effectiveness for Android malware analysis remains underexplored. Decompiled Android malware code pres…

Benchmarking Malware Analysis

Better Call Graphs: A New Dataset of Function Call Graphs for Malware Classification

2025-12-24 · Jakir Hossain, Gurvinder Singh, Lukasz Ziarek, Ahmet Erdem Sarıyüce arxiv

Function call graphs (FCGs) have emerged as a powerful abstraction for malware detection, capturing the behavioral structure of applications beyond surface-level signatures. Their utility in traditional program analysis …

Malware Classification Malware Detection

Classifying Malware Using Function Representations in a Static Call Graph

2020-12-01 · Thomas Dalton, Mauritius Schmidtler, Alireza Hadj Khodabakhshi

We propose a deep learning approach for identifying malware families using the function call graphs of x86 assembly instructions. Though prior work on static call graph analysis exists, very little involves the applicati…

Feature Engineering Malware Classification Malware Family Detection